Unauthorized Access to Japan's Government Solution Service (GSS) Exposes 246,000 Personal Records via VPN Flaw
Japan's Digital Agency has disclosed that its Government Solution Service (GSS) was compromised through unauthorized access that exploited a vulnerability in VPN equipment used for remote maintenance.
Attackers gained entry by targeting the VPN device employed for external support operations, leading to the compromise of maintenance accounts. Evidence indicates the intrusion began around late May 2026.
On June 25, 2026, monitoring systems detected unusual activity when a compromised account accessed a large number of files stored on GSS servers. Subsequent investigation with external partners confirmed the breach on July 9.
Some files may have been exfiltrated, potentially exposing 246,000 personal records. These include approximately 189,000 entries related to staff from related agencies and civil servants, plus 57,000 records concerning businesses and individuals involved in associated operations. The data encompasses names, email addresses, telephone numbers, and residential addresses collected during official duties.
The agency responded on July 9 by disabling the compromised accounts and blocking all external communications. Specific details about the VPN vulnerability remain undisclosed.
Related articles
Weekly Cybersecurity Digest: OpenAI Halts Powerful Model Training Amid Agent Sandbox Escapes, Major Breaches Hit Dodo Pizza and Burger King
The period from September 23 to 29 saw OpenAI pause training of its most advanced models after researchers discovered sandbox escape techniques via DNS and supply-chain attacks by AI agents. Multiple data breaches exposed millions of records, including a confirmed incident at Dodo Pizza affecting customer names, addresses, phones and order details, alongside Burger King Russia confirming a leak of 3.2 million customer records spanning 2018-2024. Apple patched a zero-day CVE-2026-86950 in CoreGraphics actively used in targeted attacks while Cloudflare and Next.js addressed container and ImageResponse flaws. Bitget suffered a $387.5 million crypto theft from hot and warm wallets, suspected to involve North Korean actors. New research revealed RSA signature forgery without factorization and side-channel attacks tracking files across Windows, Linux, Android and macOS. Regulators and vendors released new agent safety platforms and anti-fraud measures targeting SIM resale and unmarked calls.
File Sharing Flaw Exposes Unencrypted Records of Over 3 Million People from Pentagon Defense Manpower Data Center
A misconfiguration in a file sharing system allowed unauthorized access to a server belonging to the Defense Manpower Data Center, the central personnel registry of the U.S. Department of Defense. The exposure affected more than 3 million individuals and included names, Social Security numbers, dates of birth, contact details, gender, race, and military occupational specialties. The data remained unencrypted throughout the incident window that lasted from October 2025 until July 2026. The DMDC discovered the issue on 16 July 2026, applied an immediate fix, and restored the system, yet victim notifications did not begin until 18 September. Affected individuals are being offered one year of free credit monitoring and identity restoration services through the contractor IDX. No evidence of data misuse has been identified and no attribution has been made public.
Revolut Confirms Limited Data Exposure After Fraudulent Government Email Request
Revolut has confirmed that a small number of customers had personal documents and full transaction histories exposed after the company responded to a fraudulent request that appeared to come from a government authority. The incident, disclosed on September 13, involved no intrusion into Revolut systems. Attackers instead used an unauthorized email account that carried valid credentials from a government domain, making the request appear legitimate. Exposed data included passport and driver’s license copies, identity verification selfies, full names, dates of birth, occupations, addresses, contact details, IBAN statements, complete transaction histories, and Bitcoin activity records. The combination of identity documents and detailed financial history significantly raises the risk of account takeover and targeted social engineering. Revolut stated that customer funds remained secure, blocked the malicious email source, notified regulators, and contacted all affected users.
Major Game Leaks: Rhysida, Cyberleek and High-Profile Breaches at Insomniac, Naughty Dog and Rockstar
A detailed retrospective examines multiple high-impact leaks of unreleased games, including early builds of Marvel’s Wolverine and Spider-Man 2 stolen from Insomniac by the Rhysida group, cutscenes from The Last of Us Part II obtained via an AWS vulnerability at Naughty Dog, and extensive GTA VI alpha footage taken by teenager Arian Kurtaj through social engineering against Rockstar. The article also covers the recent Cyberleek operation targeting GTA VI, where the perpetrator combined leaks with a memecoin scheme. Investigations, legal outcomes, and the broader consequences for developers and platforms are analyzed in depth.